remove html tags from feed title

3 files changed, 7 insertions, 6 deletions

diff --git a/CHANGELOG b/CHANGELOG
index 1776c432e..1b9dded19 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -3,6 +3,7 @@ owncloud-news (2.001)
 * Also remember collapsed folders on postgres
 * Fix bug that would prevent articles from being deleted if a folder is marked as deleted on sqlite and postgres
 * Require ownCloud 6.0.2
+* Remove html tags from feed titles
 
 owncloud-news (1.808)
 * Also focus article area when clicking on all unread link
diff --git a/fetcher/feedfetcher.php b/fetcher/feedfetcher.php
index 165c03ddc..2ca4c999e 100644
--- a/fetcher/feedfetcher.php
+++ b/fetcher/feedfetcher.php
@@ -181,8 +181,8 @@ class FeedFetcher implements IFeedFetcher {
 		$feed = new Feed();
 
 		// unescape content because angularjs helps against XSS
-		$title = $this->decodeTwice($simplePieFeed->get_title(),
-			ENT_COMPAT, 'UTF-8' );
+		$title = strip_tags($this->decodeTwice($simplePieFeed->get_title(),
+			ENT_COMPAT, 'UTF-8' ));
 
 		// if there is no title use the url
 		if(!$title) {
diff --git a/tests/unit/fetcher/FeedFetcherTest.php b/tests/unit/fetcher/FeedFetcherTest.php
index fa978568e..b26c42a8d 100644
--- a/tests/unit/fetcher/FeedFetcherTest.php
+++ b/tests/unit/fetcher/FeedFetcherTest.php
@@ -110,7 +110,7 @@ class FeedFetcherTest extends \OCA\AppFramework\Utility\TestUtility {
 		$this->author = '<boogieman';
 		$this->enclosureLink = 'http://enclosure.you';
 
-		$this->feedTitle = '&lte;its a title';
+		$this->feedTitle = '<a>&its a</a> title';
 		$this->feedLink = 'http://goatse';
 		$this->feedImage = '/an/image';
 		$this->webFavicon = 'http://anon.google.com';
@@ -236,7 +236,7 @@ class FeedFetcherTest extends \OCA\AppFramework\Utility\TestUtility {
 		$this->expectCore('get_permalink', $this->feedLink, 2);
 
 		$feed = new Feed();
-		$feed->setTitle(html_entity_decode($this->feedTitle));
+		$feed->setTitle('&its a title');
 		$feed->setUrl($this->url);
 		$feed->setLink($this->feedLink);
 		$feed->setAdded($this->time);
@@ -340,7 +340,7 @@ class FeedFetcherTest extends \OCA\AppFramework\Utility\TestUtility {
 		$this->expectCore('get_permalink', $this->feedLink, 2);
 
 		$feed = new Feed();
-		$feed->setTitle(html_entity_decode($this->feedTitle));
+		$feed->setTitle('&its a title');
 		$feed->setUrl($this->url);
 		$feed->setLink($this->feedLink);
 		$feed->setAdded($this->time);
@@ -366,7 +366,7 @@ class FeedFetcherTest extends \OCA\AppFramework\Utility\TestUtility {
 		$this->expectCore('get_permalink', $this->feedLink, 2);
 
 		$feed = new Feed();
-		$feed->setTitle(html_entity_decode($this->feedTitle));
+		$feed->setTitle('&its a title');
 		$feed->setUrl($this->url);
 		$feed->setLink($this->feedLink);
 		$feed->setAdded($this->time);